✕
Image
Currently viewing ATT&CK v19.2 which was live between April 28, 2026 and October 12, 2026. Learn more about the versioning system or see the live site.
ATT&CKcon 7.0 registration is open! Join us October 27-28, 2026 in McLean, VA or virtually. Register in person or register virtually. See the FAQ for hotel and venue details.
  1. Home
  2. Software
  3. ROADTools

ROADTools

ROADTools is a framework for enumerating Azure Active Directory environments. The tool is written in Python and publicly available on GitHub.[1]

ID: S0684
ⓘ
Type: TOOL
ⓘ
Platforms: Identity Provider
Version: 1.0
Created: 18 February 2022
Last Modified: 16 September 2024
Enterprise Layer
download view Image

Techniques Used

Domain ID Name Use
Enterprise T1087 .004 Account Discovery: Cloud Account

ROADTools can enumerate Azure AD users.[2]
Enterprise T1119 Automated Collection

ROADTools automatically gathers data from Azure AD environments using the Azure Graph API.[2]
Enterprise T1526 Cloud Service Discovery

ROADTools can enumerate Azure AD applications and service principals.[2]

Enterprise T1069 .003 Permission Groups Discovery: Cloud Groups

ROADTools can enumerate Azure AD groups.[2]

Enterprise T1018 Remote System Discovery

ROADTools can enumerate Azure AD systems and devices.[2]
Enterprise T1078 .004 Valid Accounts: Cloud Accounts

ROADTools leverages valid cloud credentials to perform enumeration operations using the internal Azure AD Graph API.[2]

Groups That Use This Software

ID Name References
G0016 APT29

[3]

References

  1. Dirk-jan Mollema. (2022, January 31). ROADtools. Retrieved January 31, 2022.
  2. Dirk-jan Mollema. (2020, April 16). Introducing ROADtools - The Azure AD exploration framework. Retrieved January 31, 2022.
  1. Microsoft Threat Intelligence Center. (2021, October 25). NOBELIUM targeting delegated administrative privileges to facilitate broader attacks. Retrieved March 25, 2022.